Hacking for Christ

How would your bank know whether you perform the security measures or not without some sort of spyware?

No thanks.

They could automatically give the savings, but deduct it if the user reports any security problems. This is unlikely to happen, though, since the banks would probably lose a lot of money, and it would give their customers a disincentive to report security problems. It is probably more likely that banks will start charging security fees for people who fall for phishing scams and the like.

Well either

1) it's based on honor and we know that many people have no sense of honor when it comes to money or

2) we have allow the bank to some how access our computer to see if the necessisary precautions are taking. Well, I for one, welcome our new pc-controlling banking overlords.

Also, I don't have a software firewall (I have a router), and I don't have an spyware scanner (I'm running linux), does the bank consider me a security threat.

Banks, eh? These same institutions which _still_ are often only supporting IE?

I wouldn't have much trust in them being capable of of drating any kind of reasonable guidelines for security which wouldn't severely limit progress.

"You MUST use Firefox 1.0.2 (higher versions not allowed) or MSIE 6.0 SP 2, a virusscanner by one of these three big (expensive) companies, and have windows update enabled," sounds about right.
After that, it'll be absolutely impossible to get regular users to ever switch to anything else, because it'll _cost them money_.

Bonuses for those that have security precautions in place might be nice, but that's "carrot" again, and as other comments point out, pretty much impossible to check on effectively, especially without invading privacy.

It'd have to work the other way around - 2% interest bonus for people using online banking, and you'd lose the bonus if you made a mistake with your security in whatever way. Same kind of thing as giving people interest free credit and then whacking them with penalties if they miss a deadline by a day or whatever, or giving insurance cheap to people that don't make claims - the result is an unfair system that ends up encouraging people to do things wrong to whatever extent they can get away with it.

The idea sounds good in principle, but I can't imagine any way that banks would implement it fairly.

Pah, why put the onus on the consumer when perfectly well suitable challenge/response systems are available? See: http://www.ubs.com/1/e/ebanking/internet/internet_security/requirements.html

And it works perfectly well with all modern browsers on all operating systems.

The problem with their first requirement is that it requires users to go out an buy extra hardware - hardware that is only useful for that one thing, which costs extra money. And as far as I can tell there's nothing new in the rest of the page.

What a nice idea. Everyone has a smart card that uniquely identifies them and they muct use this card to access their bank accounts. You could put biometric data on it and personal details, next of kin etc. Of course you would always need to carry it if you ever wanted money - online or cashpoint....
Perfect.

Wait a minute.

You normally get the card and the reader for free with your account. If not it costs together with the reader something like 30$. And no, there's no biometrics in there and it only identifies yourself towards one bank. You know, for once I *want* my bank to have the possibility to identify me, no privacy concerns here.

You identify yourself with something you've got (the smartcard) and something you know (your pin) and the thing you've got can't just be copied like a sheet with numbers on it. It's a smart card with its own processor RSA/DSA unit, protection against phyiscal attacks etc. It's pretty damn secure.